基于图编辑距离的恶意代码检测

基于图编辑距离的恶意代码检测 Malware Detection Based on Graph Edit Distance 杨帆 YANG Fan 1 2 3 first-author 张焕国 ZHANG Huanguo 1 2 傅建明 FU Jianming 1 2 沈志东 SHEN Zhidong 4 武汉大学计算机学院 武汉大学计算机学院 School of Computer,Wuhan University School of Computer,Wuhan University 空天信息安全与可信计算教育部重点实验室 空天信息安全与可信计算教育部重点实验室 Key Laboratory of Aerospace Information Security and Trusted Computing of Ministry of Education Key Laboratory of Aerospace Information Security and Trusted Computing of Ministry of Education 中国地质大学(武汉)计算机学院 中国地质大学(武汉)计算机学院 Computer School,China University of Geosciences Computer School,China University of Geosciences 武汉大学国际软件学院 武汉大学国际软件学院 School of International Software,Wuhan University School of International Software,Wuhan University 传统的恶意代码检测方法漏报率高且运行效率低,很大程度的依赖于人工检测.为解决该问题,基于恶意代码自身的函数调用顺序及程序结构特征,通过静态分析技术将恶意代码抽象为函数调用图,采用图的编辑距离作为恶意代码间相似度的评估标准,将恶意代码的分类识别转化为在已建立的恶意代码图数据库中搜索最小编辑距离邻居图的问题,在此基础上实现了用户检测未知文件恶意性的系统.为了提高检测速度,引入了函数对应的汇编指令集和多路优势点树的高维索引算法.实验证明,该方案兼顾了恶意代码检测的准确性和运行效率. To overcome the disadvantages of traditional malware detection with high false negative rate and low running efficiency,we abstract function call graphs from candidate malware by static analysis.Graph edit distance is taken as the evaluation criteria of the malware similarity,and therefore the malware classification and identification is transformed into the problem of searching the nearest neighbors in the existing malware graph database.To improve the detection speed,we introduce the assembly instruction sets of functions and the multi-way vantage point tree as high-dimensional indexing algorithm.Experiments show that our method has good performance in both accuracy and efficiency of malware detection. 恶意代码检测 函数调用图 图编辑距离 多路优势点树 malware detection function call graph graph edit distance multi-way vantage point tree 10.14188/j.1671-8836.2013.05.004 TP309 国家自然科学基金（60970115,61003268,61272469,61003185）;武汉市科技攻关计划基金（2013010501010144）;中央高校基本科研业务费专项基金（CUGL120283）资助项目 2013-05-01 2021-04-01 5 59